[Ksplice][Ubuntu-18.04-Updates] New Ksplice updates for Ubuntu 18.04 Bionic (USN-5920-1)

[Oracle Ksplice]

Synopsis: USN-5920-1 can now be patched using Ksplice
CVEs: CVE-2022-3521 CVE-2022-3545 CVE-2022-3628 CVE-2022-3640 CVE-2022-3643 CVE-2022-42328 CVE-2022-42329 CVE-2022-42895 CVE-2022-4378 CVE-2023-0461

Systems running Ubuntu 18.04 Bionic can now use Ksplice to patch
against the latest Ubuntu Security Notice, USN-5920-1.

INSTALLING THE UPDATES

We recommend that all users of Ksplice Uptrack running Ubuntu 18.04
Bionic install these updates.

On systems that have "autoinstall = yes" in /etc/uptrack/uptrack.conf,
these updates will be installed automatically and you do not need to
take any action.

Alternatively, you can install these updates by running:

# /usr/sbin/uptrack-upgrade -y


DESCRIPTION

* CVE-2022-42895: Information disclosure in Bluetooth subsystem.

A missing sanity check when parsing a configuration request in Bluetooth
L2CAP implementation could result in out-of-bounds memory access.
A physically proximate attacker could use this flaw for information
disclosure.


* CVE-2022-4378: Privilege escalation in the proc filesystem.

Incorrect bounds checking and an integer overflow in the proc
filesystem could lead to out-of-bounds memory writes.  An unprivileged
user could use this flaw to cause a denial-of-service or elevate
privileges.


* CVE-2022-3545: Use-after-free in Netronome Flow Processor Ethernet driver.

A logic flaw in error handling in Netronome Flow Processor Ethernet
driver could result in a use-after-free. A local attacker could use this
flaw for a denial-of-service or code execution.


* CVE-2022-3628: Code execution in Broadcom FullMAC USB WiFi driver.

A missing sanity check when setting up the Broadcom FullMAC USB WiFi
driver could result in out-of-bounds access. A physically proximate
user could use this flaw to craft a malicious USB device and cause
a denial-of-service or execute arbitrary code.


* Note: Oracle has determined that CVE-2022-3640 is not applicable.

A logic flaw in receive data path of the Bluetooth subsystem could
result in a use-after-free. A local user could use this flaw to cause
a denial-of-service or execute arbitrary code.

Oracle has determined that this kernel is not affected by CVE-2022-3640
as the code in question is not compiled.


* CVE-2022-3521: Denial-of-service in Kernel Connection Multiplexor.

A flaw in the implementation of Kernel Connection Multiplexor sockets
could lead to a race condition when releasing sockets in some situations.
A local attacker could use this flaw to cause a denial-of-service.


* CVE-2023-0461: Use-after-free in Upper Level Protocol (ULP) subsystem.

Improper handling of sockets entering the LISTEN state in the ULP subsystem
could lead to a use-after-free. A local attacker could use this to cause a
denial-of-service or execute arbitrary code.


* CVE-2022-42328, CVE-2022-42329, XSA-424: Denial-of-service in Xen Netback driver.

A logic flaw in Xen Netback driver when trying to free the SKB of
a dropped packet in some situations could result in a deadlock.
A local user could use this flaw for a denial-of-service.


* Improved update to CVE-2022-3643: Denial-of-host-service via malicious Xen netfront packet.

The Xen netback handler does not properly handle packets with protocol
headers that span multiple slots. A malicious guest might exploit this
to crash certain varieties of network interface on the host.

SUPPORT

Ksplice support is available at ksplice-support_ww at oracle.com.